Read the docs
TI-2026-84558 Aliases CVE-2026-61495GHSA-cx2w-pw8j-8rvm

Out-of-bounds write in TinyUSB MTP helper enables memory corruption

Priority LOW 32CWE-787Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

TinyUSB through 0.21.0 contains an out-of-bounds write (CWE-787) in the MTP device class helper mtp_container_get_string(). The unchecked memcpy copies up to 510 bytes into a fixed-size destination buffer. A malicious USB host can send a crafted MTP string to corrupt adjacent memory, which can lead to code execution or denial of service on the MTP device.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtp_container_get_string() in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character count. Attackers can exploit the unchecked memcpy operation copying up to 510 bytes into a fixed-size destination buffer to achieve code execution or cause a denial of service on the TinyUSB MTP device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00266 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hathachTinyUSBup to 0.21.0—No fix listedCNA
  • TinyUSB Vendorhathach Affected up to 0.21.0 Fixed in — No fix listed CNA

Remediation

The source description says the flaw is fixed in commit e85c2b8. The sources list no fixed version for TinyUSB.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-61495
  2. 2026-11-03 Alias added: GHSA-cx2w-pw8j-8rvm
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: MEDIUM → LOW

References

Patch 1

  • TI-2026-84565 Integer underflow in TinyUSB HID report descriptor parser CVSS 4.0MEDIUM 5.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences